kaby76
HIGH SEVERITY CVE in Nuget dependencies
There is a CVE vulnerability (DOS) in the dependencies. Unfortunately overrides in the project or central package management don't work for build only dependencies. Thus, this is reported in the UI but NOT fixable by anyone except the package owner.
Seems that PR #102 is resolving the CVE, but there is no NuGet publication yet.
An update has just been released and I can confirm this fixes the issue. Thanks very much!
Any ideas on if/when the nuget will be released?
It's in 12.11 Antlr4BuildTasks. The fix was here: https://github.com/kaby76/Antlr4BuildTasks/blob/ab3340b3f0b2036cb12a4c5d75c624707b34ec0e/Antlr4BuildTasks/Antlr4BuildTasks.csproj#L49
